Overview

overview

10

Static

static

SecuriteIn...89.exe

windows7-x64

10

SecuriteIn...89.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    SecuriteInfo.com.W32.AIDetectNet.01.10589.8398
  • Size 1.1MB
  • Sample220726-ptgk2ache8
  • SHA256 cd8eba06bb4896fa2e84a9f8e9577e027a9e77fedbb5182326d942dee66b7067
  • MD5 SHA1 SHA512
Score
10/10
xloaderg6k0loaderrat

Malware Config

Extracted

Family

  • xloader

Version

  • 2.6

Campaign

  • g6k0

Decoy

  • acquarg.com

  • prayforthehorn.com

  • pocketbookwhack.com

  • easeaging.com

  • hofu-hinomarutaxi.com

  • jonesconcreteornamentals.com

  • mvcfxbo.com

  • jpfinancial.partners

  • bgstudio.online

  • jfxpm.xyz

  • amigoviajero.com

  • vrrrd.com

  • indianscafe.com

  • chancecrew.com

  • westbrookpizzeriany.com

  • goldetfs.xyz

  • hrpgoyna.club

  • yafitexchange.com

  • fromagerielacotiere.com

  • trascrss.com

Targets

    • Target
      SecuriteInfo.com.W32.AIDetectNet.01.10589.8398
    • Size 1.1MB
    • SHA256 cd8eba06bb4896fa2e84a9f8e9577e027a9e77fedbb5182326d942dee66b7067
    • MD5 SHA1 SHA512
    Score
    10/10
    xloaderg6k0loaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks